2

I have visualforce page that displays information from custom object. I get id from the url and do SOQL query in controller. Client wants to send the link to this page (hosted on Salesforce site). What is the best practices for record id? I'm not sure that is good solution to provide link like site.force.com/your_page?id=salesforce_id because we are sending original Salesforce id of the record.

3
  • Your user ca still access recordId from URL. Unless you use some manual encryption. May 1 '17 at 10:54
  • Can you please clarify your current approach and what is wrong with it?
    – Adrian Larson
    May 1 '17 at 12:01
  • Adrian, the thing is I'm not sure that is good idea to display salesforce record id of security reason. May 1 '17 at 12:22
4

For the most part, exposing an ID is completely harmless. The limited exception I'd place on that rule are 00DXXXXXXXXXXXX Id values, which can allow spammers to hit your web-to-lead or web-to-case queues if enabled. Even salesforce.com uses ID values in various places, such as Help & Training, the Developer Forums, etc. For example, here's a question (picked at random) from the Developer Forums:

https://developer.salesforce.com/forums#!/feedtype=SINGLE_QUESTION_DETAIL&dc=Developer_Forums&criteria=ALLQUESTIONS&id=9060G000000UUKbQAO

However, what is important is to make sure your code runs "with sharing", so that the user can't query or modify a record they shouldn't have access to, and make sure your security model (OWD, FLS, profiles, sharing rules, etc) are correctly configured.

0
0

If you want the URL to be in encoded form then you can have a java-script button that will encode the id and will send it to custom attribute with a random name like not a obvious name like '?Id=*' . Then you can in constructor get the apex parameter value, decode it and run the SOQL.

2
  • Thanks Adrian! That is good point. As @sfdcfox mentioned I can use id but I should sharing rules/profile settings correctly. May 1 '17 at 12:57
  • @EugeneVabishchevich Just want to point out that this answer was given by Rachit, not Adrian (Adrian simply made a couple of simple edits).
    – Derek F
    May 1 '17 at 13:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.